URLhaus Database

You are currently viewing the URLhaus database entry for http://130.12.180.20:36695/mpsl which is being or has been used to serve malware. Please consider that URLhaus does not differentiate between websites that have been compromised by hackers and such that has been setup by cybercriminals for the sole purpose of serving malware.

Database Entry


ID:3745425
URL: http://130.12.180.20:36695/mpsl
URL Status:flame Online (spreading malware for 23 days, 4 hours, 37 minutes)
Host: 130.12.180.20
Date added:2025-12-28 17:21:08 UTC
Threat:Malware download Malware download
Reporter: botnetkiller
Abuse complaint sent (?): Yes (2025-12-28 17:22:13 UTC to abuse{at}virtualine[dot]org)
Tags:elf geofenced mips mirai link ua-wget USA

Payload delivery


The table below documents all payloads that URLhaus retrieved from this particular URL.

FirstseenFilenameFile TypePayload (SHA256)VTBazaarSignature
2026-01-20n/aelf 92e00f25af8c2e8c251282b85e34ac47bc698f127dc7c4fe8db98f429214cb1bn/a
2026-01-05n/aelf de34d431540466c6ac41a25ace0589ce07c212b473a86b45a74256d38e672292n/aMirai
2026-01-02n/aelf c31b9c7f355c00e671b162ffdb5c07182a32dbdbe693852d536bb3c1ff42df34n/aMirai
2026-01-01n/aelf 667b9524b62595d4172407c8f0426e83f71cc4d448d4307c5a4bab84032ff9a8n/aMirai
2025-12-28n/aelf e2f49b929531ddce009e62e076af65a97785fe9732012fb13e968ffab3164f43n/aMirai